Posterous theme by Cory Watilo

Filed under: Apple's security

Apple Releases Another Security Update With iOS 4.3.5

update

Apple’s none too fond of nasty security flaws lurking about in iOS, and they’re not above cracking out rapid-fire updates to prove it. Just 10 days after the release of iOS 4.3.4 (which existed almost solely to kill off a potentially nasty PDF exploit), they’re back with another one: iOS 4.3.5.

The main fix in this minor patch? A fix for a security flaw which might allow “attacker with a privileged network position may capture or modify data in sessions protected by SSL/TLS”. In other words, hackers on the same network could store or change traffic that would otherwise be rather intensely encrypted.

Unlike that last patch (which, due to the exploit patched, did away with the one-click-jailbreak site JailbreakMe), this one seems to have no affect on jailbreakers. According to Redmond Pie, the only jailbreak method that still worked with 4.3.4 (tethered redsn0w) still seems to get the job done here.

This one’s pretty hefty for a security patch, coming in at a whopping 666 megabytes. Once iOS 5 and its fancy over-the-air/delta updates (wherein only the stuff that has changed needs to be downloaded), these one-off security updates should be a whole lot less time consuming.

RELATED POSTS:

 

Anonymous says it’s breached Apple’s security

The Anonymous hacker group claimed Sunday that it had stolen a small number of internal passwords and user names from an Apple server.

The data was reportedly stolen from a server used for Apple’s online surveys and did not belong to Apple’s own customers. It was publicly posted on a file-sharing web site, pastebin.

Anonymous claimed responsibility for the attack. It is reportedly working closely with hackers who belonged to Lulz Sec, the hacking group that said it was disbanding last week after 50 days of hacker havoc that included hacking sites such as PBS.org.

The breach at Apple exposed 27 internal Apple usernames and passwords. We’ve sent an email to Apple asking for comment.

On Twitter, Anonymous said Apple could become a target, but for now the members were busy with other hacking targets. “Apple could be target, too. But don’t worry, we are busy elsewhere,” the group said. Earlier this month, Lulz Sec claimed it had breached Apple’s iCloud servers, which operate the company’s cloud music and photo service. But the group posted no evidence of the hack.